Google AdSense sets advertising cookies such as __gads, __gpi and __eoi, so in the EEA, the UK and Switzerland it needs the visitor's consent before those cookies are written. For personalised ads Google also requires a Google-certified consent management platform (CMP) integrated with the IAB Transparency and Consent Framework (TCF), and since 1 March 2026 every new consent string must be TCF v2.3. A visitor who refuses storage does not mean no ads: Google can still serve Limited Ads, which use no local identifier except cookies for invalid-traffic detection.
Google's EU User Consent Policy and AdSense
Every website running Google AdSense in the European Economic Area, United Kingdom, or Switzerland must follow Google's EU User Consent Policy. This policy translates the obligations of the GDPR and the ePrivacy Directive into concrete technical requirements that Google enforces at the ad-serving level.
The policy requires you to disclose how your site uses cookies and personal data for ad personalisation. Visitors must give affirmative consent before non-essential cookies fire, including cookies used for frequency capping, aggregated reporting, and fraud prevention on personalised and non-personalised ads. A passive "continue browsing" model does not satisfy Google's requirements.
Non-compliance carries real consequences. Google may suspend your AdSense account after issuing a non-compliance notice, cutting off ad revenue entirely.
The cookies AdSense sets
As of October 2026, Google's list of advertising cookies names these for AdSense and Google Ad Manager, among others:
| Cookie | Lifetime | What it does |
|---|---|---|
__gads | 13 months | Lets sites show Google ads |
__gpi | 13 months | Listed by Google for AdSense and Ad Manager |
__eoi | 6 months | Listed by Google for AdSense and Ad Manager |
IDE | 13 months in the EEA and UK, 24 months elsewhere | Shows Google ads on non-Google sites |
test_cookie | 15 minutes | Checks whether the browser accepts cookies |
All of them are storage on the visitor's device under Article 5(3) of the ePrivacy Directive, so they wait for consent in the same way analytics cookies do.
The certified CMP requirement
Google's certified CMP requirement has applied since 16 January 2024 in the EEA and UK, and since 31 July 2024 in Switzerland. To serve personalised ads there, publishers must use a consent management platform that holds Google certification and integrates with the IAB Transparency and Consent Framework. Google's own Privacy and messaging tool is one certified option.
A certified CMP handles the technical handshake between your consent banner and Google's ad stack. When a visitor makes a consent choice, the CMP generates a TC string, a standardised encoded signal that tells Google (and every other vendor in the programmatic chain) exactly what the user has permitted. Traffic from a non-certified CMP cannot receive personalised ads and may get non-personalised or Limited Ads at most. AdSense for Search is stricter: without a certified CMP, or Google's invalid-traffic parameter, it serves no ads at all.
Your CMP must meet several criteria to qualify:
- Registration with the IAB Europe as a TCF CMP
- Passing Google's certification process
- Generating valid TC strings that include Google's vendor ID
- Displaying all required vendor disclosures in the consent interface
TCF v2.3: the 2026 switch and what changed
The IAB released TCF v2.3 to address a significant gap in earlier versions. Under TCF v2.2, there was ambiguity about whether a vendor had actually been disclosed to the user in the CMP interface. A vendor could appear in the TC string without the user ever seeing its name, a problem that regulators flagged repeatedly.
TCF v2.3 makes the disclosedVendors segment mandatory. This signal confirms that each vendor listed in the TC string was genuinely shown to the user before consent was collected. Google's TCF troubleshooting page states that v2.3 is mandatory for every TC string generated on or after 1 March 2026, while v2.1 and v2.2 strings generated before 28 February 2026 are still accepted until they are renewed.
That switch has now happened.
Google reports error code 1.4 when the disclosed vendors segment of a v2.3 string is missing, malformed, or does not include Google (vendor ID 755). In that case Google cannot operate on the ad request, so check that your CMP produces v2.3 strings and lists Google Advertising Products.
Revenue impact of non-compliance
Limited Ads serve only non-personalised, contextual advertising, and they usually earn less than personalised ads. Google publishes no general figure for the difference, which depends on your audience, ad formats and the share of visitors who consent. For publishers relying on programmatic advertising, the financial impact shows up as soon as consent rates or string errors change.
Google Consent Mode v2 and AdSense
Google Consent Mode v2 works alongside the TCF integration. It communicates user consent status to all Google tags on your page through four consent types, of which ad_storage, ad_user_data and ad_personalization govern advertising. When they are set to denied, Google's tags adjust their behaviour: cookies like __gads, __gpi, and _gcl_au are not set, and no personal data is collected for ad targeting.
Google added ad_user_data and ad_personalization in November 2023, and has required those signals for ads personalisation and measurement on EEA traffic since March 2024. Tags without proper consent signals lose personalisation and remarketing for those visitors.
| Consent signal | Effect when granted | Effect when denied |
|---|---|---|
ad_storage | Ad cookies set normally (__gads, __gpi) | No ad cookies written to browser |
ad_personalization | Personalised ads served, remarketing active | Only contextual or non-personalised ads |
ad_user_data | User data sent to Google for ad purposes | No user data shared for advertising |
analytics_storage | Analytics cookies set (_ga, _ga_<container-id>) | Cookieless pings with limited data |
Setting up your consent banner for AdSense
Your cookie banner needs specific elements to satisfy Google's policy. Name ads personalisation plainly on the first layer: a vague reference to "third-party cookies" does not tell visitors what they are agreeing to.
The banner must also include:
- A clear affirmative action for consent (button labelled "Accept" or similar)
- An equally accessible option to refuse (no dark patterns hiding the reject button)
- A link to Google's Business Data Responsibility site
- A list of vendors or a link to the full vendor list within the TCF interface
Consent must be collected before any ad-related cookies are set. If your implementation fires AdSense tags on page load and only asks for consent afterwards, you are already in breach of both GDPR cookie consent rules and Google's policy.
Blocking AdSense before consent
The technical implementation depends on how you load AdSense. If you use Google Tag Manager, set up a consent initialisation trigger that fires before any other tags. Your CMP should push consent state to the dataLayer, and your AdSense tag should only fire when ad_storage and ad_personalization are both granted.
For direct AdSense code integration, wrap the ad script in a conditional loader that checks consent status through your CMP's JavaScript API. Alternatively, use type="text/plain" on the script tag and let your CMP swap it to text/javascript once consent is given.
What happens when visitors reject consent
A rejection does not switch AdSense off. Google separates three kinds of ad serving, and the visitor's choices decide which one applies:
- Personalised ads need consent to store information on the device and to personalise ads, and they use advertising cookies.
- Non-personalised ads still need consent for storage, because they can use cookies for frequency capping, reporting and fraud detection.
- Limited Ads are served when the visitor's choices allow neither. According to Google's Limited Ads documentation, they disable all personalisation and every feature that needs a local identifier, using only cookies and local storage for invalid-traffic detection.
Google says it does not require publishers to obtain consent for that invalid-traffic use, while reminding publishers that their own consent tools remain their responsibility. In Google Ad Manager, programmatic Limited Ads are on by default and can be turned off in the network settings, if your legal team prefers no storage at all after a refusal.
Which ads an EEA visitor can get
For publishers concerned about revenue loss from rejected consent, consider these approaches:
- Improve banner design to increase consent rates without using manipulative patterns
- Use server-side tagging to reduce visible third-party cookies
- Diversify revenue beyond programmatic ads (subscriptions, sponsorships, affiliate)
Common AdSense consent mistakes
| Mistake | Why it fails | Fix |
|---|---|---|
| Loading AdSense before consent | Cookies set without legal basis | Block scripts until CMP callback confirms consent |
| Using a non-certified CMP | Google cannot read the TC string | Switch to a Google-certified CMP with TCF integration |
| Missing vendor disclosures | TCF v2.3 requires the disclosed vendors segment | Check that the CMP lists all vendors, including Google |
| No "ads personalisation" text on the banner | Visitors cannot give informed consent to an unnamed purpose | Add a clear reference to personalised advertising on the first layer |
| Consent Mode not implemented | Google tags ignore consent state | Implement Consent Mode v2 with correct default values |
AdSense consent questions
Do I need a certified CMP for AdSense in 2026?
Yes, for personalised ads. Since 16 January 2024 in the EEA and UK, and 31 July 2024 in Switzerland, Google requires a CMP that is both Google-certified and integrated with the IAB Transparency and Consent Framework. Without one, traffic gets non-personalised or Limited Ads at most.
What is TCF v2.3 and why does it matter for AdSense?
TCF v2.3 is the latest version of the IAB's Transparency and Consent Framework. It requires a disclosedVendors segment in the TC string to prove that vendors were actually shown to users. Google requires v2.3 for every TC string generated from 1 March 2026.
Can I run AdSense without any cookies?
Not fully. Personalised and non-personalised ads use cookies and need consent for them. Limited Ads, which Google serves when a visitor allows neither, use only cookies and local storage for invalid-traffic detection, and Google says it does not require consent for that use.
How much revenue do publishers lose without consent?
Google publishes no general figure. Limited and non-personalised ads usually earn less than personalised ads, and the gap depends on your audience geography, ad formats and the proportion of visitors who decline consent.
Does Google Consent Mode v2 replace the TCF requirement?
No. Consent Mode v2 and TCF serve different functions. Consent Mode communicates consent state to Google tags, while the TCF provides the standardised consent string required by the programmatic advertising ecosystem. AdSense publishers in the EEA, UK and Switzerland need the TCF string for personalised ads.
What happens if my CMP still uses TCF v2.2?
v2.2 strings generated before 28 February 2026 are still accepted until they are renewed, but new strings must be v2.3. A v2.3 string whose disclosed vendors segment is missing or leaves out Google returns error 1.4, and Google cannot operate on that request.
Check the TC string your CMP sends
Kukie.io does not generate TCF strings, so AdSense publishers who want personalised ads in the EEA, UK and Switzerland need a Google-certified TCF CMP alongside or instead of it. Whichever CMP you use, paste a consent string into the TCF string decoder to see its version, its purposes and whether Google appears in the disclosed vendors.
